644d017f9bc45b980d5f520e4c5e5fcb99d5d741b54e461dd81b985d5817ff0d

Sharing

Copy URL Twitter E-mail

General

Target

644d017f9bc45b980d5f520e4c5e5fcb99d5d741b54e461dd81b985d5817ff0d
Size

7.8MB
MD5

dd4cf420478551becd5681dd932f579b
SHA1

2d8db4a3a1ae59795bf7478918a4d65c214df84b
SHA256

644d017f9bc45b980d5f520e4c5e5fcb99d5d741b54e461dd81b985d5817ff0d
SHA512

9016e664a9d2ef502caf7d525e34df370e9c2d8eaa54ea5c8054f5c48036d69cd28a7cb0a37d7e6273a53feb5c873a3de43941523755151b41681f7995a9dea3
SSDEEP

196608:mW40qv5wvYmVybScE0bA5VMZ7Yk6pKpdrpUi2j57kJzvrlO4yf0fRFku7miN5Tlf:H/qv5wvYmVZuA5U7Yk6pKpdrpO7SUfE1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
644d017f9bc45b980d5f520e4c5e5fcb99d5d741b54e461dd81b985d5817ff0d

Files

644d017f9bc45b980d5f520e4c5e5fcb99d5d741b54e461dd81b985d5817ff0d
.exe windows:6 windows x86 arch:x86

5051fb0b04f48a48e2daaceb04f3e0f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
QueryPerformanceCounter
GetModuleFileNameW
FileTimeToSystemTime
CompareStringW
GetStringTypeW
SetEnvironmentVariableA
FindNextFileW
UnhandledExceptionFilter
IsProcessorFeaturePresent
MoveFileExW
GetTimeZoneInformation
FlushFileBuffers
CreateThread
SetUnhandledExceptionFilter
CreateFileW
FindFirstFileExW
InitializeCriticalSection
GetOEMCP
GetFullPathNameW
CloseHandle
GetVersionExA
GetCurrentDirectoryW
LCMapStringW
GetStartupInfoW
FreeLibrary
DeleteCriticalSection
DeleteFileW
GetEnvironmentVariableA
TlsSetValue
PeekNamedPipe
GetACP
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
SetFilePointerEx
FreeEnvironmentStringsW
GetConsoleMode
LeaveCriticalSection
GetProcessHeap
TlsFree
GetStdHandle
GetProcAddress
GetCurrentProcess
FindClose
WriteConsoleW
HeapSize
GetTickCount
GetModuleHandleW
GetFileSizeEx
GetSystemDirectoryA
GetFileAttributesExW
GetCommandLineW
IsValidCodePage
Sleep
EnterCriticalSection
GetCurrentProcessId
MoveFileExA
FreeLibraryAndExitThread
GetFileType
GetModuleHandleExW
ReadFile
WriteFile
GetConsoleCP
ReadConsoleW
WaitForMultipleObjects
IsDebuggerPresent
HeapAlloc
GetCommandLineA
GetLastError
GetEnvironmentStringsW
SetEndOfFile
GetCurrentThreadId
ExitThread
InitializeSListHead
GetDriveTypeW
RaiseException
InitializeCriticalSectionAndSpinCount
QueryPerformanceFrequency
LoadLibraryA
ExitProcess
DecodePointer
SleepEx
LoadLibraryExW
TlsGetValue
HeapReAlloc
GetCPInfo
SetLastError
FormatMessageA
CreateFileA
WaitForSingleObject
SetStdHandle
RtlUnwind
TerminateProcess
TlsAlloc
GetSystemTimeAsFileTime
GetModuleHandleA
HeapFree

user32

TranslateMessage
GetWindowRect
FillRect
PostMessageW
GetSystemMetrics
DrawTextW
LoadIconW
RegisterClassExW
EndPaint
DispatchMessageW
ShowWindow
UpdateWindow
DefWindowProcW
PostQuitMessage
GetClientRect
RedrawWindow
MessageBoxW
CreateWindowExW
GetMessageW
BeginPaint
SetWindowPos

gdi32

SetBkMode
SetTextColor
CreateSolidBrush
DeleteObject

advapi32

CryptGenRandom
CryptDestroyKey
RegEnumKeyExA
CryptGetHashParam
CryptImportKey
CryptHashData
CryptAcquireContextA
CryptEncrypt
CryptCreateHash
CryptDestroyHash
CryptReleaseContext

crypt32

PFXImportCertStore
CertOpenStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CertFindExtension
CertAddCertificateContextToStore
CertGetCertificateChain
CryptQueryObject
CertFreeCertificateContext
CertCreateCertificateChainEngine
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateChain

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord45
ord60
ord22
ord211
ord50
ord143
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
select
__WSAFDIsSet
ioctlsocket
gethostname
ntohl

Sections

.text
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5051fb0b04f48a48e2daaceb04f3e0f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 7.4MB - Virtual size: 7.4MB

.rdata Size: 183KB - Virtual size: 182KB

.data Size: 44KB - Virtual size: 57KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 99KB - Virtual size: 99KB

.text
Size: 7.4MB - Virtual size: 7.4MB

.rdata
Size: 183KB - Virtual size: 182KB

.data
Size: 44KB - Virtual size: 57KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 99KB - Virtual size: 99KB